How would you implement HTTP request timeout and connection management on the server side in Node.js to protect against slow-loris style attacks?

A slow-loris attack sends HTTP requests very slowly (a few bytes at a time) to exhaust a server's available connections, since each connection stays open waiting for the request to complete -- Node's http.Server exposes several relevant timeout settings (headersTimeout, requestTimeout, and the server-level timeout for the overall connection) that can be configured to forcibly close connections that take too long, protecting against both malicious slow attacks and simply misbehaving or extremely slow legitimate clients.

const server = http.createServer(app);
server.headersTimeout = 60000;  // max time to receive complete headers
server.requestTimeout = 300000; // max time for the entire request
server.timeout = 120000;        // socket inactivity timeout
server.listen(3000);